HTTP Headers

HTTP headers are metadata fields sent between web browsers and servers during every web request and response, controlling how content is delivered, cached, and secured. When you visit a website, your browser sends request headers (User-Agent, Accept, Cookies) and the server responds with response headers containing crucial information. Key response headers: Server identifies web server software (Apache, Nginx, IIS). Content-Type specifies the content format (text/html, application/json). Cache-Control and Expires dictate browser caching behavior. Set-Cookie establishes session cookies. Content-Encoding shows compression (gzip, brotli). X-Powered-By reveals application frameworks (PHP, ASP.NET). Security headers protect against attacks: Content-Security-Policy (CSP), Strict-Transport-Security (HSTS), X-Frame-Options, X-Content-Type-Options, and X-XSS-Protection. Headers also control CORS (Cross-Origin Resource Sharing), redirects (Location header), authentication (WWW-Authenticate), and content delivery. Analyzing headers reveals: server technology stack, security posture, caching strategy, CDN usage, and potential vulnerabilities. This information is essential for web development, security auditing, performance optimization, and debugging.

Enter the website URL (including https://) and the tool fetches and displays all HTTP response headers. Critical security headers to verify: Strict-Transport-Security (HSTS) forces HTTPS connections and prevents protocol downgrade attacks. Should be: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload. Missing HSTS leaves users vulnerable to man-in-the-middle attacks. Content-Security-Policy (CSP) prevents XSS attacks by controlling resource loading. Example: default-src 'self'; script-src 'self' https://trusted-cdn.com. Absence allows malicious script injection. X-Frame-Options prevents clickjacking by controlling iframe embedding. Should be: DENY or SAMEORIGIN. Missing allows attackers to embed your site in malicious frames. X-Content-Type-Options: nosniff prevents MIME-type sniffing attacks. Referrer-Policy controls information leakage in referrer headers. Permissions-Policy (formerly Feature-Policy) restricts browser features like geolocation, camera, microphone. Red flags: Exposed server versions (Server: Apache/2.4.1 reveals specific version for exploit targeting), X-Powered-By revealing framework versions, missing security headers entirely, permissive CORS headers (Access-Control-Allow-Origin: *), or outdated/insecure configurations. Security scanners and compliance standards (PCI DSS, OWASP) require these headers.

Caching headers control whether and how long browsers and CDNs store website resources, dramatically impacting load times and bandwidth usage. Cache-Control is the primary modern caching directive. Cache-Control: public, max-age=31536000 means the resource can be cached by browsers and proxies for 1 year (31536000 seconds) - ideal for static assets like images, CSS, JavaScript with versioned filenames. Cache-Control: private, max-age=3600 allows only browser caching (not shared proxies) for 1 hour - good for user-specific content. Cache-Control: no-cache requires revalidation with the server before using cached content (uses ETags or Last-Modified). Cache-Control: no-store prevents any caching - use for sensitive data like banking transactions. Expires is the legacy header specifying an absolute expiration date: Expires: Wed, 21 Oct 2026 07:28:00 GMT. Cache-Control takes precedence over Expires when both present. ETag is a unique identifier for resource versions, enabling efficient revalidation. Last-Modified shows when the resource last changed. Performance impact: Proper caching reduces server load (fewer requests), decreases bandwidth costs, and dramatically improves page load times. For example, caching static assets for 1 year means returning visitors load instantly from local cache. Common mistakes: No caching on static assets (slow repeat visits), over-caching dynamic content (users see stale data), or cache-control on HTML pages preventing updates.

HTTP headers reveal significant information about website infrastructure. Server header identifies web server software: Server: nginx/1.21.6 (Nginx), Server: Apache/2.4.52 (Ubuntu), Server: Microsoft-IIS/10.0 (Windows Server), or Server: cloudflare (behind Cloudflare CDN). Security-conscious sites obscure this: Server: redacted or remove it entirely. X-Powered-By reveals application frameworks: X-Powered-By: PHP/8.1.2, X-Powered-By: ASP.NET, or X-Powered-By: Express (Node.js). CDN indicators: Headers like CF-Ray and CF-Cache-Status indicate Cloudflare. X-Amz-Cf-Id shows Amazon CloudFront. X-Cache: HIT from cloudfront confirms CDN caching. Via: 1.1 varnish indicates Varnish cache. Load balancer clues: X-Load-Balancer, X-LB-IP, or multiple server responses suggest load-balanced infrastructure. Hosting providers: Some add identifying headers like X-Served-By: cache-lax-kwhp1940067-LAX (Fastly), X-GitHub-Request-Id (GitHub Pages). Programming languages/frameworks: Session cookie names reveal technology: PHPSESSID (PHP), JSESSIONID (Java), ASP.NET_SessionId (ASP.NET). Examining the complete header set provides a comprehensive technology fingerprint useful for competitive analysis, security assessment, or development research.

CORS (Cross-Origin Resource Sharing) headers control whether websites can access resources from different domains, enforcing the same-origin security policy. By default, browsers block JavaScript on example.com from fetching data from api.otherdomain.com. CORS headers allow controlled exceptions. Key CORS headers: Access-Control-Allow-Origin specifies which domains can access the resource. Access-Control-Allow-Origin: https://trusted-site.com allows only that domain. Access-Control-Allow-Origin: * allows any domain (dangerous for authenticated APIs but okay for public data). Access-Control-Allow-Methods lists permitted HTTP methods: GET, POST, PUT, DELETE. Access-Control-Allow-Headers specifies allowed custom headers: Content-Type, Authorization, X-Custom-Header. Access-Control-Allow-Credentials: true permits cookies and authentication headers in cross-origin requests. Access-Control-Max-Age caches preflight responses to reduce overhead. Troubleshooting CORS errors: Browser console shows: 'Access to fetch at 'https://api.example.com' from origin 'https://myapp.com' has been blocked by CORS policy'. Check if API sends Access-Control-Allow-Origin header matching your domain. For authenticated requests, ensure Access-Control-Allow-Credentials is true AND Access-Control-Allow-Origin is NOT * (must be specific domain). For custom headers or methods beyond simple requests (GET, POST with standard headers), the browser sends a preflight OPTIONS request - server must respond with appropriate Allow headers. Use the HTTP Headers Lookup tool to verify API responses include correct CORS headers.

Redirect headers instruct browsers to load different URLs, indicated by HTTP status codes in the 3xx range. 301 Moved Permanently signals the resource has permanently moved to the URL in the Location header. Search engines transfer ranking signals to the new URL. Use for permanent domain changes or URL restructuring. 302 Found (Temporary Redirect) indicates temporary relocation. Search engines maintain the original URL in indexes. Use for A/B testing or temporary maintenance pages. 307 Temporary Redirect is like 302 but preserves the HTTP method (POST remains POST). 308 Permanent Redirect is like 301 with method preservation. 303 See Other forces GET method, commonly used after form submissions. Redirect chains occur when multiple redirects happen sequentially (A→B→C→D), harming performance and SEO. Each redirect adds network latency (200-500ms per hop). Diagnosing chains: The HTTP Headers Lookup tool shows each redirect step with status codes and Location headers. Example chain: Request http://example.com → 301 to https://example.com → 301 to https://www.example.com → 301 to https://www.example.com/home → 200 OK. This 4-hop chain wastes 1-2 seconds. Best practices: Minimize redirects; update links directly to final destination. Avoid redirect loops (A→B→A) which break sites entirely. Use 301 for SEO consolidation (merging www and non-www versions). CDNs and load balancers sometimes add redirects - check with header analysis to identify optimization opportunities.